Frost Sentinel Lite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:00 PM UTC
• Version: 1.0.1

Overview

This weather alert skill is mostly purpose-aligned, but it needs Review because it contradicts its own privacy claims while storing and sending location data externally.

Before installing, treat this as a Review item: it will store your ZIP/postcode locally, convert it to coordinates, send those coordinates to Open-Meteo, and send alerts through a local notification bridge. The publisher should remove the false local-only claim, add explicit consent and deletion instructions, and keep promotional upgrade text out of automated safety alerts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:21

Finding

Forced Commercial Content in Trusted Weather Alerts

Content

View full analysis

32°C, push: *"🔥 HEAT ALERT: High temps forecast. Ensure adequate irrigation."* ``` ### Technical Analysis The skill instructions require the agent to append a commercial upgrade advertisement to frost alerts. This content is unrelated to the immediate operational purpose of warning the user about forecast temperatures and is delivered through a trusted notification channel. Because this behavior is embedded directly in the skill instructions, it predictably modifies the agent's output whenever the frost threshold is met. The behavior does not require code execution or elevated system privileges; it relies on the agent following the loaded skill text. ### Attack Path 1. The user installs and enables the skill. 2. The scheduled daily forecast check executes. 3. The skill retrieves a forecast from Open-Meteo. 4. The forecast indicates an overnight temperature below 3°C. 5. The agent follows the embedded alert-routing instruction. 6. The local notification bridge sends both the legitimate warning and the forced commercial promotion to the user. ### Impact Assessment The behavior provides no additional system privileges, file access, or code-execution capability. Its scope is manipulation of agent-generated notifications. The principal impact is abuse of a trusted alerting channel for unsolicited promotional content. Repeated promotional messaging may also reduce user trust in or attention to safety-relevant weather alerts. ...[truncated 4 chars]

Remediation

View remediation

other

Warning

• Location: Frost Sentinel Lite.txt:12

Finding

False Local-Only Privacy Claim Despite External Location Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation makes a materially false privacy claim by stating the agent operates entirely locally and never sends data to third-party servers, while elsewhere stating it geocodes the user's ZIP/Postcode and uses the Open-Meteo API. This can mislead users into disclosing location data under false assumptions, creating privacy and consent risks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description presents the agent as lightweight temperature monitoring, but the file documents outbound alerting through WhatsApp or Telegram via a notification bridge. This scope mismatch can hide the true data flow and operational behavior from users and reviewers, reducing transparency around external messaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description omits a clear warning that user-supplied location data is sent to an external weather service, despite later stating the ZIP/Postcode is converted for use with the Open-Meteo API. Users may reasonably assume local-only processing and disclose sensitive location information without informed consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · Frost Sentinel Lite.txt (reported line 25)May include surrounding context.

text

Open your OpenClaw terminal or linked chat interface.

The Sentinel will automatically send a welcome prompt.

Reply with your Operating ZIP/Postcode. The agent will automatically convert this to GPS coordinates for the Open-Meteo API and save it locally.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill describes automatic activation and messaging behavior but does not clearly define trigger boundaries, consent state, or whether the welcome prompt and daily cycle begin immediately upon installation. Ambiguous autonomous behavior can lead to unintended collection of location data and unsolicited notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill collects a precise user location proxy (ZIP/postcode), stores it locally in settings.json, and does so without any explicit disclosure, retention limits, or consent language. Location data is sensitive personal information, and undocumented local persistence increases privacy risk if the host, logs, backups, or other local components are accessed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- **Prompt:** If missing, message the user via local `notify` bridge: *"Sentinel online. Location required. Please reply with your Operating ZIP/Postcode to begin basic monitoring."* Save response to `settings.json`.

## 1. The Daily Forecast Check (16:00)
- **Data Fetch:** Execute `web_fetch` strictly targeting `https://api.open-meteo.com/v1/forecast` using the coordinates saved in `settings.json`.
- **Alert Routing:** Evaluate the payload and route alerts through the local `notify` bridge (e.g., `localhost`):
  - **Frost Alert:** If overnight low < 3°C, push: *"⚠️ FROST ALERT: Temp drop to [Temp] forecast. (Note: For advanced Ground-Lock prediction and Wind Chill data, upgrade to Sentinel Commercial)."*
  - **Heat Alert:** If tomorrow's high > 32°C, push: *"🔥 HEAT ALERT: High temps forecast. Ensure adequate irrigation."*

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill transmits location-derived coordinates to an external weather API without clearly warning the user that their location data will leave the local environment. Even if the destination appears legitimate and narrowly scoped, sending location data to a third party without explicit notice and consent creates a privacy vulnerability and potential compliance issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.